[codex] Prevent recurring deployment stalls

README.md

@@ -103,7 +103,9 @@ turn merges made by that token into ordinary `push` workflow runs, so DeployBot
 dispatches each configured CI workflow once after it merges a batch. GitHub can
 also suppress the usual `workflow_run` handoff after that token-driven CI run,
 so DeployBot explicitly dispatches each configured deployment workflow after
-exact-main CI succeeds. CI workflows must accept `workflow_dispatch`.
+exact-main CI succeeds. A compare-and-set Git ref leases each exact CI dispatch,
+so concurrent followers cannot launch the same production deployment twice.
+CI workflows must accept `workflow_dispatch`.
 Deployment workflows must accept `workflow_dispatch` inputs named `ci_sha` and
 `ci_run_id`, verify that run through the GitHub API, and deploy only when it is
 successful CI for the current base-branch head. Skipped deployment wake-ups

adapters/claude-code/skills/deploybot/SKILL.md

@@ -7,6 +7,9 @@ description: Inspect and operate the full DeployBot delivery pipeline. Use when
 
 Read `.mergequeue.toml` before acting. Prefer the DeployBot MCP tools; fall back
 to the `deploybot` CLI. Treat GitHub as the durable source of truth.
+If the task worktree does not contain the policy, use the repository's known
+configured checkout or pass its path with `--config`; never run `deploybot init`
+inside an existing task worktree merely to read status.
 
 ## Read Status
 

adapters/codex/agent-merge-queue/skills/deploybot/SKILL.md

@@ -7,6 +7,9 @@ description: Inspect and operate the full DeployBot delivery pipeline. Use when
 
 Read `.mergequeue.toml` before acting. Use the `deploybot` CLI directly and
 treat GitHub as the durable source of truth.
+If the task worktree does not contain the policy, use the repository's known
+configured checkout or pass its path with `--config`; never run `deploybot init`
+inside an existing task worktree merely to read status.
 
 ## Read Status
 

adapters/cursor/AGENTS.md

@@ -3,6 +3,8 @@
 Read `.mergequeue.toml` and use the `deploybot` MCP tools. Keep changing
 pull requests draft and make the final ready head immutable. Address valid
 feedback from the configured review providers.
+If a task worktree lacks the policy, pass the repository's configured policy
+path explicitly; never initialize a second policy just to read status.
 
 For read-only status, use `pipeline_status` for the full delivery path,
 `queue_plan` for the merge queue, and `inspect_pull_request` for one PR. Report

docs/reference.md

@@ -15,6 +15,8 @@ current directory. `--repository` defaults to the repository resolved by the
 GitHub CLI. `--version` prints the installed version. Wherever `[PR]` appears,
 the selector may be a pull-request number, URL, or branch; when omitted,
 DeployBot resolves the pull request for the current branch.
+If an existing task worktree lacks the policy, run from the configured checkout
+or pass `--config PATH`; do not initialize a second policy just to inspect it.
 
 ### Setup and read-only inspection
 

skills/deploybot/SKILL.md

@@ -7,6 +7,9 @@ description: Inspect and operate the full DeployBot delivery pipeline. Use when
 
 Read `.mergequeue.toml` before acting. Prefer the DeployBot MCP tools; fall back
 to the `deploybot` CLI. Treat GitHub as the durable source of truth.
+If the task worktree does not contain the policy, use the repository's known
+configured checkout or pass its path with `--config`; never run `deploybot init`
+inside an existing task worktree merely to read status.
 
 ## Read Status